Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`transfer` function in RToken contract applies scaling 2 times, leading to wrong amount of tokens transferred.

tadev

Summary

Current design seems to choose to apply scaling in _update function. Indeed, mint and burn functions pass to _mint and _burn functions the amount of underlying asset. Then, the overridden _update function applies the scaling to get the amount of interest-bearing token before minting or burning.

The problem is that transfer first applies a scaling, and then calls super.transfer which will call _update, applying a second scaling. This is incorrect, leading to excess scaling, transferring less tokens than expected while transaction is successful for a given amount passed as argument.

function transfer(address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
return super.transfer(recipient, scaledAmount);
}
​
function _update(address from, address to, uint256 amount) internal override {
// Scale amount by normalized income for all operations (mint, burn, transfer)
uint256 scaledAmount = amount.rayDiv(ILendingPool(_reservePool).getNormalizedIncome());
super._update(from, to, scaledAmount);
}

Vulnerability Details

Impact

The impact of this vulnerability is high as it leads to systematic transfers of less tokens than expected with the transfer function. This might break future integration of RAAC protocol.

Tools Used

Manual review.

Recommendations

Ensure that only one division scaling is applied: remove scaling in transfer and transferFrom functions and only apply the scaling in _update function.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

RToken::transfer and transferFrom double-scale amounts by dividing in both external functions and _update, causing users to transfer significantly less than intended

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.